diff --git a/board-qemu/slof/Makefile b/board-qemu/slof/Makefile
index 6f2796e..17af4de 100644
--- a/board-qemu/slof/Makefile
+++ b/board-qemu/slof/Makefile
@@ -76,7 +76,8 @@ OF_FFS_FILES = \
 	$(SLOFCMNDIR)/fs/xmodem.fs \
 	$(SLOFBRDDIR)/default-font.bin \
 	$(SLOFBRDDIR)/pci-phb.fs \
-	$(SLOFBRDDIR)/rtas.fs
+	$(SLOFBRDDIR)/rtas.fs \
+	$(SLOFBRDDIR)/pci-device_1234_1111.fs
 
 # Uncomment the following line to enable the USB code:
 OF_FFS_FILES += $(USB_FFS_FILES)
diff --git a/board-qemu/slof/OF.fs b/board-qemu/slof/OF.fs
index 7d571b4..38f1d01 100644
--- a/board-qemu/slof/OF.fs
+++ b/board-qemu/slof/OF.fs
@@ -151,6 +151,24 @@ check-for-nvramrc
 #include "elf.fs"
 #include <loaders.fs>
 
+8a8 cp
+
+: enable-framebuffer-output  ( -- )
+\ enable output on framebuffer
+   s" screen" find-alias ?dup  IF
+      \ we need to open/close the screen device once
+      \ before "ticking" display-emit to emit
+      open-dev close-node
+      s" display-emit" $find  IF 
+         to emit 
+      ELSE
+         2drop
+      THEN
+   THEN
+;
+
+enable-framebuffer-output
+
 8b0 cp
 
 \ Scan USB devices
@@ -161,6 +179,35 @@ usb-scan
 \ Claim remaining memory that is used by firmware:
 romfs-base 400000 0 ' claim CATCH IF ." claim failed!" cr 2drop THEN drop
 
+8d0 cp
+
+: set-default-console
+    s" linux,stdout-path" get-chosen IF
+        decode-string
+        ." Using default console: " 2dup type cr
+        io
+        2drop
+    ELSE
+        ." No console specified "
+        " screen" find-alias dup IF nip THEN
+        " keyboard" find-alias dup IF nip THEN
+	AND IF
+	  ." using screen & keyboard" cr
+	  " screen" output
+	  " keyboard" input
+        ELSE
+          " hvterm" find-alias IF
+	    drop
+	    ." using hvterm" cr
+            " hvterm" io
+	  ELSE
+	    ." and no default found" cr
+	  THEN
+        THEN
+    THEN
+;
+set-default-console
+
 8ff cp
 
 #include <start-up.fs>
diff --git a/board-qemu/slof/pci-device_1234_1111.fs b/board-qemu/slof/pci-device_1234_1111.fs
new file mode 100644
index 0000000..1f7fd23
--- /dev/null
+++ b/board-qemu/slof/pci-device_1234_1111.fs
@@ -0,0 +1,288 @@
+my-space pci-device-generic-setup
+
+\ Defaults, overriden from qemu
+d# 800 CONSTANT disp-width
+d# 600 CONSTANT disp-height
+d#   8 CONSTANT disp-depth
+
+\ Thomas uses "evaluate" here in virtio, dunno why, let's do the same
+s" 10 config-l@ translate-my-address 3 not AND" evaluate VALUE fb-base
+
+\ Fixed up later
+-1 VALUE io-base
+
+\ We support only one instance
+false VALUE is-installed?
+
+: vga-io-xlate ( port -- addr )
+  io-base -1 = IF
+    dup translate-my-address fff not and to io-base
+  THEN
+  io-base +
+;
+
+: vga-w! ( value port -- )
+  vga-io-xlate rw!-le
+;
+
+: vga-w@ ( port -- value )
+  vga-io-xlate rw@-le
+;
+
+: vga-b! ( value port -- )
+  vga-io-xlate rb!
+;
+
+: vga-b@ ( port -- value )
+  vga-io-xlate rb@
+;
+
+: vbe!	( value index -- )
+  1ce vga-w! 1d0 vga-w!
+;
+
+: vbe@	( index -- value )
+  1ce vga-w! 1d0 vga-w@
+;
+
+
+\ **************************************************************************
+\ ** These come from vga-display.fs and should probably be moved to a common
+\ ** location.
+
+: draw-rectangle ( adr x y w h -- )
+   is-installed? IF
+      0 ?DO
+         4dup ( adr x y w adr x y w )
+         drop ( adr x y w adr x y )
+         i + screen-width * + \ calculate offset into framebuffer ((y + i) * screen_width + x) 
+         ( adr x y w adr offs ) 
+         frame-buffer-adr + \ add to frame-buffer-adr ( adr x y w adr fb_adr ) 
+         1 pick 3 pick i * + swap 3 pick ( adr x y w adr adr_offs fb_adr w )
+         rmove \ copy line ( adr x y w adr )
+         drop ( adr x y w )
+      LOOP
+      4drop
+   ELSE
+      4drop drop
+   THEN
+;
+
+: fill-rectangle ( number x y w h -- )
+   is-installed? IF
+      0 ?DO
+         4dup ( number x y w number x y w )
+         drop ( number x y w number x y )
+         i + screen-width * + \ calculate offset into framebuffer ((y + i) * screen_width + x) 
+         ( number x y w number offs ) 
+         frame-buffer-adr + \ add to frame-buffer-adr ( number x y w number adr ) 
+         2 pick 2 pick ( number x y w number adr w number )
+         rfill \ draw line ( number x y w number )
+         drop ( number x y w )
+      LOOP
+      4drop
+   ELSE
+      4drop drop
+   THEN
+;
+
+: read-rectangle ( adr x y w h -- )
+   is-installed? IF
+      0 ?DO
+         4dup ( adr x y w adr x y w )
+         drop ( adr x y w adr x y )
+         i + screen-width * + \ calculate offset into framebuffer ((y + i) * screen_width + x) 
+         ( adr x y w adr offs ) 
+         frame-buffer-adr + \ add to frame-buffer-adr ( adr x y w adr fb_adr ) 
+         1 pick 3 pick i * + 3 pick ( adr x y w adr fb_adr adr_offs w )
+         rmove \ copy line ( adr x y w adr )
+         drop ( adr x y w )
+      LOOP
+      4drop
+   ELSE
+      4drop drop
+   THEN
+;
+
+\ ** end of copy from vga-display.fs
+\ **************************************************************************
+
+: color! ( r g b number -- ) 
+   3c8 vga-b!
+   rot 3c9 vga-b!
+   swap 3c9 vga-b!
+   3c9 vga-b!
+;
+
+: color@ ( number -- r g b ) 
+   3c8 vga-b!
+   3c9 vga-b@
+   3c9 vga-b@
+   3c9 vga-b@
+;
+
+: set-colors ( adr number #numbers -- )
+   over 3c8 vga-b!
+   swap DO
+     rb@ 3c9 vga-b!
+     rb@ 3c9 vga-b!
+     rb@ 3c9 vga-b!
+   LOOP
+   3drop
+;
+
+: get-colors ( adr number #numbers -- )
+   3drop
+;
+
+: default-palette
+  \ Grayscale ramp for now, be smarter later
+  100 0 DO
+    i i i i color!
+  LOOP
+;
+
+\ qemu fake VBE IO registers
+0 CONSTANT VBE_DISPI_INDEX_ID
+1 CONSTANT VBE_DISPI_INDEX_XRES
+2 CONSTANT VBE_DISPI_INDEX_YRES
+3 CONSTANT VBE_DISPI_INDEX_BPP
+4 CONSTANT VBE_DISPI_INDEX_ENABLE
+5 CONSTANT VBE_DISPI_INDEX_BANK
+6 CONSTANT VBE_DISPI_INDEX_VIRT_WIDTH
+7 CONSTANT VBE_DISPI_INDEX_VIRT_HEIGHT
+8 CONSTANT VBE_DISPI_INDEX_X_OFFSET
+9 CONSTANT VBE_DISPI_INDEX_Y_OFFSET
+a CONSTANT VBE_DISPI_INDEX_NB
+
+\ ENABLE register
+00 CONSTANT VBE_DISPI_DISABLED
+01 CONSTANT VBE_DISPI_ENABLED
+02 CONSTANT VBE_DISPI_GETCAPS
+20 CONSTANT VBE_DISPI_8BIT_DAC
+40 CONSTANT VBE_DISPI_LFB_ENABLED
+80 CONSTANT VBE_DISPI_NOCLEARMEM
+
+: init-mode
+  0 3c0 vga-b!
+  VBE_DISPI_DISABLED VBE_DISPI_INDEX_ENABLE vbe!
+  0 VBE_DISPI_INDEX_X_OFFSET vbe!
+  0 VBE_DISPI_INDEX_Y_OFFSET vbe!
+  disp-width VBE_DISPI_INDEX_XRES vbe!
+  disp-height VBE_DISPI_INDEX_YRES vbe!
+  disp-depth VBE_DISPI_INDEX_BPP vbe!
+  VBE_DISPI_ENABLED VBE_DISPI_8BIT_DAC or VBE_DISPI_INDEX_ENABLE vbe!
+  0 3c0 vga-b!
+  20 3c0 vga-b!
+;
+
+: clear-screen
+  fb-base disp-width disp-height * 0 rfill
+;
+
+: read-settings
+  s" qemu,graphic-width" get-chosen IF
+     decode-int to disp-width 2drop
+  THEN
+  s" qemu,graphic-height" get-chosen IF
+     decode-int to disp-height 2drop
+  THEN
+  s" qemu,graphic-depth" get-chosen IF
+     decode-int nip nip     
+       dup 8 =
+       over 10 = or
+       over 20 = or IF
+         to disp-depth
+       ELSE
+         ." Unsupported bit depth, using 8bpp " drop cr
+       THEN
+  THEN
+;
+
+: add-legacy-reg
+  \ add legacy I/O Ports / Memory regions to assigned-addresses
+  \ see PCI Bus Binding Revision 2.1 Section 7.
+  s" reg" get-node get-property IF
+    \ "reg" does not exist, create new
+    encode-start
+  ELSE
+    \ "reg" does exist, copy it 
+    encode-bytes
+  THEN
+  \ I/O Range 0x1ce-0x1d2
+  my-space a1000000 or encode-int+ \ non-relocatable, aliased I/O space
+  1ce encode-64+ 4 encode-64+ \ addr size
+  \ I/O Range 0x3B0-0x3BB
+  my-space a1000000 or encode-int+ \ non-relocatable, aliased I/O space
+  3b0 encode-64+ c encode-64+ \ addr size
+  \ I/O Range 0x3C0-0x3DF
+  my-space a1000000 or encode-int+ \ non-relocatable, aliased I/O space
+  3c0 encode-64+ 20 encode-64+ \ addr size
+  \ Memory Range 0xA0000-0xBFFFF
+  my-space a2000000 or encode-int+ \ non-relocatable, <1MB Memory space
+  a0000 encode-64+ 20000 encode-64+ \ addr size
+  s" reg" property \ store "reg" property
+;
+
+: setup-properties
+   \ Shouldn't this be done from open ?
+   disp-width encode-int s" width" property
+   disp-height encode-int s" height" property
+   disp-width disp-depth 8 / * encode-int s" linebytes" property
+   disp-depth encode-int s" depth" property
+   s" ISO8859-1" encode-string s" character-set" property \ i hope this is ok...
+   \ add "device_type" property
+   s" display" encode-string s" device_type" property
+   s" qemu,std-vga" encode-string s" compatible" property
+   \ XXX We don't create an "address" property because Linux doesn't know what
+   \ to do with it for >32-bit
+;
+
+\ words for installation/removal, needed by is-install/is-remove, see display.fs
+: display-remove ( -- ) 
+;
+
+: display-install ( -- )
+   is-installed? NOT IF
+      disp-depth 8 = IF
+        ." Installing QEMU fb" cr
+        fb-base to frame-buffer-adr
+        clear-screen
+        default-font 
+        set-font
+        disp-width disp-height disp-width char-width / disp-height char-height / ( width height #lines #cols )
+        fb8-install 
+        true to is-installed?
+     THEN
+   THEN
+;
+
+: dimensions ( -- width height )
+  disp-width disp-height
+;
+
+: set-alias
+  disp-depth 8 = IF
+    s" screen" find-alias 0= IF
+      \ no previous screen alias defined, define it...
+      s" screen" get-node node>path set-alias
+    ELSE
+       drop
+    THEN 
+  THEN
+;
+
+
+." qemu vga" cr
+
+pci-master-enable
+pci-mem-enable
+pci-io-enable
+add-legacy-reg
+read-settings
+init-mode
+default-palette
+setup-properties
+' display-install is-install
+' display-remove is-remove
+set-alias
diff --git a/board-qemu/slof/tree.fs b/board-qemu/slof/tree.fs
index 166b138..627c4bd 100644
--- a/board-qemu/slof/tree.fs
+++ b/board-qemu/slof/tree.fs
@@ -53,6 +53,10 @@ device-end
 ;
 fixup-tbfreq
 
+4d0 cp
+
+include fbuffer.fs
+
 500 cp
 
 : populate-vios ( -- )
@@ -179,16 +183,3 @@ s" /mmu" open-dev encode-int s" mmu" set-chosen
 
 #include <term-io.fs>
 
-: set-default-console
-    s" linux,stdout-path" get-chosen IF
-        decode-string
-        ." Using default console: " 2dup type cr
-        io
-        2drop
-    ELSE
-        " hvterm" find-alias IF drop
-            " hvterm" io
-        THEN
-    THEN
-;
-set-default-console
